Skip to main content

Questions tagged [capabilities]

POSIX Capabilities are a way to split full superuser privileges into smaller partitions of privileges. Use this tag for questions on managing and using capabilities.

Filter by
Sorted by
Tagged with
0 votes
1 answer
27 views

Setting large fs.pipe-max-size

When I increase fs.pipe-max-size like so: echo "fs.pipe-max-size = N" >> /etc/sysctl.conf sysctl -p (N is ~4-10Mbytes) And use F_SETPIPE_SZ to change named pipe sizes to N, sometimes ...
JAre's user avatar
  • 125
0 votes
0 answers
104 views

Why can't root edit /var/spool/cron/crontabs?

[Please, I don't want to know why I shouldn't edit it; I want to know why I can't edit it] # pwd /var/spool/cron/crontabs # ll sysadmin -rw------- 1 sysadmin crontab 210 Jun 17 16:05 sysadmin # getcap ...
QF0's user avatar
  • 305
0 votes
1 answer
45 views

How to increase kernel parameter (`msgmnb`) for a systemd-nspawn container

I have a systemd-nspawn container in which I am trying to change the kernel parameter for msgmnb. When I try to change the kernel parameter by directly writing to the /proc filesystem or using sysctl ...
Yeow_Meng's user avatar
  • 409
0 votes
1 answer
26 views

What is the proper syntax of capsh --caps?

capsh --caps is documented in --help as, --caps=xxx set caps as per cap_from_text() What is the right syntax here? Can anyone demonstrate this working?
Evan Carroll's user avatar
  • 31.7k
0 votes
0 answers
34 views

Why do Instruction Pointers in eBPF stack trace contain the eBPF program twice with the same IP, and a weird unrelated IP?

When taking kernel stack traces in an eBPF program, I get duplicate and a seemingly weird entry: can someone please shed some light on this? Let's start with the eBPF program fragments that are ...
TheDiveO's user avatar
  • 1,337
3 votes
1 answer
304 views

Why does chown reset/remove the SUID bit and reset capabilities?

This command: sudo chown -R root:root directory will remove the SUID bit and reset all capabilities for files. I wonder why it's done silently and it's not mentioned in the man page. Weirdly the GUID ...
Artem S. Tashkinov's user avatar
1 vote
1 answer
189 views

Assign capability to systemd service and specific user

I am working on an embedded system device which basically has root user. I have a systemd service call.service which works fine with root access. The service basically creates a few sockets and then ...
gst's user avatar
  • 141
0 votes
1 answer
389 views

After executing setcap, why I still can't use tar and got an error "operation not permitted"?

Question I'm doing my internship, working on container security and recently I need to build a container which has security problem to do some tests. Here is my dockerfile FROM dockerfiles/centos-lamp ...
propoba's user avatar
  • 103
1 vote
0 answers
69 views

Effects of dropping "AUDIT_WRITE", "KILL", "SETFCAP" and "SETPCAP" capabilities while running docker

I'm exploring Docker container capabilities and permissions and I'm curious about the implications of dropping the "AUDIT_WRITE", "KILL", "SETFCAP" and "SETPCAP"...
arsalan yavari's user avatar
0 votes
0 answers
249 views

capabilities in AppArmor profile vs extended attributes

I'm trying understand AppArmor capabilities at the moment. I found an example which had me make a copy of /bin/ping and generate AppArmor profile for it. First I made a copy of /bin/ping and set it's ...
xycainoff's user avatar
2 votes
1 answer
984 views

Allowing a non-root user to create TUN/TAP interfaces

I have a situation where I need a non-root user to be allowed to create TUN/TAP interfaces. I understand that this requires the CAP_NET_ADMIN capability. There have been other questions about this, ...
Jordan's user avatar
  • 131
3 votes
1 answer
300 views

docker run cap-drop=net_bind_service still has nginx running on the port 80

docker run --rm --cap-drop=net_bind_service --publish 8080:80 --name nginx nginx ps --forest -fC nginx UID PID PPID C STIME TTY TIME CMD root 449870 449847 0 12:38 ? ...
DmitrySemenov's user avatar
1 vote
1 answer
174 views

Is POSIX 1e Capabilities widely implemented?

Do somebody know what are the Operating Systems that implemented capabilities (i.e. Posix 1e)? are they compatible? will capabilities reduce portability to Linux only?
user3435121's user avatar
5 votes
1 answer
242 views

What happened to CAPNG_SELECT_AMBIENT?

Three years ago, I wrote a program to manipulate the CAP_NET_RAW capability of my programs. I used the AMBIENT capability set. But now, I'm not able to compile my program on my actual Debian distro (...
user3435121's user avatar
3 votes
1 answer
392 views

Launch process with limited capabilities on minimal Busybox-based system

In a minimal Busybox-based Linux system with access to the root user, how can one launch a process with a specific limited set of Linux capabilities(7) without requiring any tools beyond busybox?
Axel Fontaine's user avatar
0 votes
0 answers
32 views

How to allow every admin access except viewing and editing a single directory?

We have some servers running our web application as well as nginx, redis and a few other services. I want to grant access to these servers to a system administrator to manage these systems, but I want ...
mhk's user avatar
  • 145
3 votes
1 answer
773 views

How do I enable unprivileged_userns_clone selectively for one executable or user?

How do I enable CLONE_NEWUSER in a more fine-grained fashion compared to just kernel.unprivileged_userns_clone? I want to keep kernel API attack surface manageable by keeping new and complicated ...
Vi.'s user avatar
  • 5,813
4 votes
1 answer
1k views

What mechanism prevents me from reading /proc/<PID>/environ in containers with a PID namespace shared with the host?

While investigating sharing the PID namespace with containers, I noticed something interesting that I don't understand. When a container shares the PID namespace with the host, some processes have ...
Dejan Zelic's user avatar
5 votes
2 answers
240 views

Preventing POSIX capabilities proliferation

Generally speaking, a unix (or specifically Linux) program can't do something like using ICMP_ECHO ("ping") to check the accessibility of a router unless either run by the superuser or ...
Mark Morgan Lloyd's user avatar
1 vote
1 answer
396 views

Reproduce setcap behavior with capsh

There is a non-capability-aware program that requires at least 1) cap_sys_admin and 2) either cap_dac_override or cap_dac_read_search. This can be proven as follows: sudo setcap 'all=ep cap_sys_admin-...
PlushBeaver's user avatar
1 vote
1 answer
163 views

capsh works but systemd doesn't - Openvpn unprivileged user

OS: Debian 11 Package: OpenVPN 2.5.1 Background: After an update, Openvpn-2.5 clients can no longer use iproute to modify the interface and configure routes pushed by the OpenVPN server after root ...
depar's user avatar
  • 89
1 vote
1 answer
221 views

why a non root user call getenv on an exported variable returns nil

C code here: #include <stdio.h> #include <stdlib.h> int main () { printf("PATH : %s\n", getenv("PATH")); printf("HOME : %s\n", getenv("HOME"))...
Steve Wu's user avatar
1 vote
1 answer
371 views

Can two different sets of capabilities be set to one file?

I'd like to set different capabilities to permitted and inherited sets of my file. Something like this: sudo setcap cap_fsetid=ei mybinary sudo setcap cap_kill=ep mybinary However, the latter command ...
Ekaterina's user avatar
0 votes
0 answers
1k views

Program cannot acquire the capabilities it needs (raw sockets)

Note: This is partly a programming question, but my gut feeling is that this has more to do with the Linux' security capabilities framework in general, hence posting here instead of StackOverflow. I ...
huoneusto's user avatar
  • 131
1 vote
0 answers
111 views

How does libpcap read network packets, and why can it not operate in some VMs?

I'm interested to learn how libpcap reads network packets, as I am finding it is not possible when running on AWS Lambda From what I can understand, you need either or both of the CAP_NET_ADMIN and ...
Matty F's user avatar
  • 111
0 votes
1 answer
3k views

How to get list of Linux capabilities

I need to get a list of capabilities available to the version of linux on which the program is executed. Just in order to give user possibility to choose what capability to grant to the file. Is there ...
Ekaterina's user avatar
2 votes
1 answer
693 views

Are capabilities per-process or per-thread attributes?

Documentation says that capabilities are per-thread attributes. Indeed in any /proc/[PID]/task/[LWP]/status we can find capabilities, related to this thread: CapInh: 0000000000000000 CapPrm: ...
Ekaterina's user avatar
2 votes
1 answer
356 views

How can an unprivileged file have an enabled effective bit? (POSIX capabilities)

I'm trying to understand POSIX-capabilities principles, their transformation during execve() to be more specific. I'll put some quotes from documentation during my question: P'(ambient) = (...
Ekaterina's user avatar
1 vote
0 answers
118 views

Is there any tool or method to debug an error about `open fileXXX: Operation not permitted?`

I have a running program trying to open and write to a file under systemd folder: /etc/systemd/system/mysqld_3310.service.d/u_iops_value but got this error: write /etc/systemd/system/mysqld_3310....
Steve Wu's user avatar
1 vote
1 answer
239 views

Which actions a non-root process can't do?

Obviously, it can not rwx files that it doesn't have permission to. But I am talking about other "actions", I know of them is binding to ports with lower number than 1024. What else ?
boredaf's user avatar
  • 181
0 votes
1 answer
379 views

Not able to assign root privilege to my process again by using setuid(0) in the same boot cycle

I have added the capability by using following cmd on terminal (alternative of setting CAP_SETUID in drop-in file). Verified that setuid/seteuid is working. setcap cap_sys_admin,cap_setuid+ep /...
Anshu Gangwar's user avatar
1 vote
1 answer
996 views

getpcaps not working in ubuntu 20.04 with linux 5.11.0-38-generic

I saw on StackOverflow https://stackoverflow.com/a/64000118/8507296 to check capabilities of the process using command getpcaps <pid> Output of ps command $ ps PID TTY TIME CMD ...
PSKP's user avatar
  • 111
6 votes
2 answers
768 views

Granting Capabilities to a user through PAM doesn't apply to SSH

I am using CentOS 8, and I would like to grant a user the cap_dac_read_search capability though PAM. It seems to work through local login and su, but not through ssh. I followed these steps, and only ...
ben's user avatar
  • 73
3 votes
1 answer
3k views

What is the relation between CAP_NET_RAW and net.ipv4.ping_group_range?

I am using rootless containers, according to the buildah docs, Moreover, pinging from a rootless container does not work because it lacks the CAP_NET_RAW security capability that the ping command ...
Evan Carroll's user avatar
  • 31.7k
2 votes
3 answers
233 views

Unable to use the `==` argument of `capsh` to re-exec it?

I am experimenting with capsh of libcap2-bin (1:2.32-1), but have found that I'm unable to use the == argument to re-exec capsh. In particular, when I'm using the capsh's == argument, it's complaining ...
Shuzheng's user avatar
  • 4,571
2 votes
1 answer
492 views

Why is CAP_CHROOT equivalent to root?

I have trouble understanding the root-equivalence of CAP_CHROOT given the below template. I understand that 1) means to create a directory structure, containing all dependencies (e.g. shared objects), ...
Shuzheng's user avatar
  • 4,571
0 votes
1 answer
2k views

How to read /proc/PID/maps without sudo? [duplicate]

I want to read the memory map (/proc/PID/maps) of some process without being sudo. And that is trivial, unless, the process has capabilities. See what I mean: If I run: $ bash $ cat /proc/$$/maps ...
Pablo Rodríguez's user avatar
0 votes
1 answer
594 views

Do cap_setfcap capability can be used to grant full capabilities to an exe file?

I have a file (let's call it prog) that has the cap_setfcap capabiility. Can I use it to grant prog (the file itself) full capabilities? I know it's not recommended, I just want to know if it can be ...
Harel's user avatar
  • 1
6 votes
1 answer
8k views

Why ping works without capability and setuid [duplicate]

I learned from here that there's 2 ways to control privileged activities: setuid and capability. But when I'm playing around with ping on my machine, it seems that it can bypass these 2 mechanism. ...
zingdle's user avatar
  • 185
1 vote
1 answer
657 views

Linux Security Best practice: CAP_SETFCAP vs sudoer file

I am new to linux securities and tried to understand what's the best practice for linux capabilities. Here is my scenario: I have an executable file (let's call it foo) which needs to grant ...
Howard  Yu's user avatar
4 votes
1 answer
582 views

How can a process hold a capability in another namespace?

I'm brooding over the interactions between namespaces and capabilities. Occasionally, I stumble over wording like the following from user_namespaces(7): Holding CAP_SYS_ADMIN within the user ...
stefan's user avatar
  • 1,111
2 votes
1 answer
3k views

Should I grant sudo to a user or add CAP_SYS_ADMIN capabilities to use nvprof/ncu? And why?

Since CUDA 10.1, users are required to have sudo privileges to collect advanced metrics with cuda profiling tools such as nvprof or nsight compute (ncu). Alternatives to get around it are described ...
nico's user avatar
  • 183
2 votes
1 answer
2k views

Linux capabilities for modifying files owned by root?

Is there any linux capability to enable normal users to write into root owned files like /etc/resolv.conf and /etc/fstab`?
Ejonas GGgg's user avatar
20 votes
2 answers
5k views

How does ping work on Fedora without setuid and capabilities?

As far as I know, ping needs to create a raw socket (which needs either root access or cap_net_raw capabilities). From my understanding the trend these last years has been to remove setuid binaries ...
Antoine Catton's user avatar
3 votes
2 answers
892 views

Does the root user bypass capability checking?

Does the root user bypass capability checking in the kernel, or is the root user subject to capability checking starting with Linux 2.2? May applications check for and deny access for the root user, ...
Shuzheng's user avatar
  • 4,571
1 vote
1 answer
425 views

linux capabilities to read environment variables?

I'd like to run a service as a non-privileged user, but it needs to bind to a system port number (i.e. less than 1024), so I give it setcap 'cap_net_bind_service=+ep' <path for service>, all ...
code9016's user avatar
24 votes
1 answer
19k views

What is the difference between AmbientCapabilities and CapabilityBoundingSet?

I am trying to create a systemd service for a web server process that has to bind to port 80 and 443. I found some examples setting AmbientCapabilities=CAP_NET_BIND_SERVICE and setting both ...
AIcfpNaWbMmItYvxbWwED's user avatar
3 votes
2 answers
1k views

Capability inheritable for system() call in C/C++

Currently I'm trying to understand capabilities in Linux by reading http://man7.org/linux/man-pages/man7/capabilities.7.html I created a small C++ application with the capability CAP_DAC_READ_SEARCH+...
svanschu's user avatar
0 votes
1 answer
203 views

Does "Polkit" make use of linux capabilities?

I know that some authentication programs like KDE's KAuth can use polkit as the backend.And what makes polkit special is that it can grant some specific privileges to a non-privileged process.A ...
Parsa Mousavi's user avatar
1 vote
2 answers
2k views

What does capsh --print actually do?

I understand that Linux capabilities are defined on processes/files. But when I do capsh --print, it tells me the capabilities of the user. So what exactly is capsh --print doing? Capabilities are ...
Kyoma's user avatar
  • 111